Resubmissions

27-05-2024 12:44

240527-pyl2badh29 10

27-05-2024 12:27

240527-pmwrdabh7w 1

General

  • Target

    https://cdn.discordapp.com/attachments/1243167395011498108/1244332132315172925/premum_Satup--2024_D0wnloade.zip?ex=6654ba1a&is=6653689a&hm=f78042e7b7ba39b3c50d1237a9c9da28ba42e2788bc567adf719478625c8e16a&

  • Sample

    240527-pyl2badh29

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://tubewelfaredopw.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Targets

    • Target

      https://cdn.discordapp.com/attachments/1243167395011498108/1244332132315172925/premum_Satup--2024_D0wnloade.zip?ex=6654ba1a&is=6653689a&hm=f78042e7b7ba39b3c50d1237a9c9da28ba42e2788bc567adf719478625c8e16a&

    Score
    10/10
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks